Lua isn't really sandbox friendly, although that's a common misconception.
Lua (by design) doesn't provide termination guarantees or a good way to force an untrusted program to terminate. If you accept untrusted lua input, be prepared for your program to halt indefinitely.
Lua is great for semi-trusted input, AKA things you download from the internet, where you do a minimal amount of due diligence, but in case the code is actually malicious, you want to severely limit (but not completely eliminate) the harm it can do.
If you actually need Javascript-style completely untrusted input,, what you want is the Roblox fork called Luau[1].